Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021553)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315819);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/20");

  script_cve_id("CVE-2024-56592");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021553)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-021553 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Call free_htab_elem() after htab_unlock_bucket()

    For htab of maps, when the map is removed from the htab, it may hold the
    last reference of the map. bpf_map_fd_put_ptr() will invoke
    bpf_map_free_id() to free the id of the removed map element. However,
    bpf_map_fd_put_ptr() is invoked while holding a bucket lock
    (raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock
    (spinlock_t), triggering the following lockdep warning:

      =============================
      [ BUG: Invalid wait context ]
      6.11.0-rc4+ #49 Not tainted
      -----------------------------
      test_maps/4881 is trying to lock:
      ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70
      other info that might help us debug this:
      context-{5:5}
      2 locks held by test_maps/4881:
       #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270
       #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80
      stack backtrace:
      CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
      Call Trace:
       <TASK>
       dump_stack_lvl+0x6e/0xb0
       dump_stack+0x10/0x20
       __lock_acquire+0x73e/0x36c0
       lock_acquire+0x182/0x450
       _raw_spin_lock_irqsave+0x43/0x70
       bpf_map_free_id.part.0+0x21/0x70
       bpf_map_put+0xcf/0x110
       bpf_map_fd_put_ptr+0x9a/0xb0
       free_htab_elem+0x69/0xe0
       htab_map_update_elem+0x50f/0xa80
       bpf_fd_htab_map_update_elem+0x131/0x270
       htab_map_update_elem+0x50f/0xa80
       bpf_fd_htab_map_update_elem+0x131/0x270
       bpf_map_update_value+0x266/0x380
       __sys_bpf+0x21bb/0x36b0
       __x64_sys_bpf+0x45/0x60
       x64_sys_call+0x1b2a/0x20d0
       do_syscall_64+0x5d/0x100
       entry_SYSCALL_64_after_hwframe+0x76/0x7e

    One way to fix the lockdep warning is using raw_spinlock_t for
    map_idr_lock as well. However, bpf_map_alloc_id() invokes
    idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a
    similar lockdep warning because the slab's lock (s->cpu_slab->lock) is
    still a spinlock.

    Instead of changing map_idr_lock's type, fix the issue by invoking
    htab_put_fd_value() after htab_unlock_bucket(). However, only deferring
    the invocation of htab_put_fd_value() is not enough, because the old map
    pointers in htab of maps can not be saved during batched deletion.
    Therefore, also defer the invocation of free_htab_elem(), so these
    to-be-freed elements could be linked together similar to lru map.

    There are four callers for ->map_fd_put_ptr:

    (1) alloc_htab_elem() (through htab_put_fd_value())
    It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of
    htab_put_fd_value() can not simply move after htab_unlock_bucket(),
    because the old element has already been stashed in htab->extra_elems.
    It may be reused immediately after htab_unlock_bucket() and the
    invocation of htab_put_fd_value() after htab_unlock_bucket() may release
    the newly-added element incorrectly. Therefore, saving the map pointer
    of the old element for htab of maps before unlocking the bucket and
    releasing the map_ptr after unlock. Beside the map pointer in the old
    element, should do the same thing for the special fields in the old
    element as well.

    (2) free_htab_elem() (through htab_put_fd_value())
    Its caller includes __htab_map_lookup_and_delete_elem(),
    htab_map_delete_elem() and __htab_map_lookup_and_delete_batch().

    For htab_map_delete_elem(), simply invoke free_htab_elem() after
    htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just
    like lru map, linking the to-be-freed element into node_to_free list
    and invoking free_htab_elem() for these element after unlock. It is safe
    to reuse batch_flink as the link for node_to_free, because these
    elements have been removed from the hash llist.

    Because htab of maps doesn't support lookup_and_delete operation,
    __htab_map_lookup_and_delete_elem() doesn't have the problem, so kept
    it as
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-021553
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?89169876");
  # https://lore.kernel.org/linux-cve-announce/2024122700-CVE-2024-56592-d4b2@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a31701f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-56592");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-56592");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}